Casino spammer
Got hit by a trackback spammer on annelisabeth today. Just one. And he’s left a few comments before. Not enough to be a nuisance, but enough to establish a pattern.
IP addresses:
first: 81.218.241.143
bzq-218-241-143.red.bezeqint.net
now: 82.80.40.210
bzq-80-40-210.red.bezeqint.net
Those servers are in Israel
He’s using blogspot, and one domain with whoisprotection (GoDaddy). The domain name is not in the zone (ie, not served).
He appears to have yet another website (images hosted on a domain name), web-tfx.com. That site is on a bezeqint server:
82.80.252.53
bzq-80-252-53.dcenter.bezeqint.net
It appears to be for sale. Javascript reveals the minimum price is over 10.000 dollars. I’d consider that a joke. Or rather, a fake for sale sign.
Another site is on:
62.219.82.1
cust-219-82-1.cust.bezeqint.net
The posts on one of this blogs are entered by Ertha Kitt.
User agents:
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.0.3705)
trackback:
Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Header: HTTP_VIA=1.1 DRP-CACHE-7-B (NetCache NetApp/5.6.1D21)
This spammer has many domains. Many of the domains end in this: -tfx.com
Any idea why? I did find one domain on a server that appears to have sites only belonging to the spammer.
Gehl, Chaim support@trafix-ltd.com
Trafix-Computing Services LTD
6th Uri
Tel Aviv 64684
Israel
0544573249 Fax — 035223077
The dialing prefix given on another domain was: +972
Hmm, I guess now I know what tfx stands for…
They’re moonlighting as SEO professionals as well:
http://www.trafix-ltd.com/
I guess prospective customers should be aware that they’re also spammers?
Another Israeli site says about them:
This young company is moving forward in the area of Web Site Marketing, particularly in the area of Online Gambling. The site provides visitors with a clear path for understanding how the whole web site marketing process works.
BTW, here’s another spamrun from them today.
May 2nd, 2005 at 4:32 pm
[…] utfit - who knows. As for what the spammer is peddling, I’ve written him up before: Casino spammer His newest domain name: mcr8.com Whois protected, of course. […]
January 8th, 2006 at 8:39 am
got another name for this spam:via netstat:
bzq-82-81-255-239.cablep.bezeqint.net:55332 ESTABLISHED
it slows my internet flow extensively
how can I get rid of it?
March 10th, 2006 at 1:12 pm
What would you like me to do with tfx? I live in Tel Aviv and I can probably mess with him professionally thru my trade group — about 900 women in hi-tech.
Or has the problem gone away?
Joan
March 16th, 2006 at 5:15 am
if i was you i wouldent try to get near by them!!!
they can fix you up as well
April 24th, 2006 at 9:28 am
i think you should report the IRS in israel that trafix-ltd is not paying taxes, that’s a known fact.
October 16th, 2006 at 1:42 am
I just got him via 82.80.252.50